Azure subscription management problem

Question

I have been assigned an Azure subscription owner role to perform Azure Monitor configuration and deployment, under my subscription info i see this:
Error details Code: AuthorizationFailed Message: The client '******@yourcompany.com' with object id 'xxxxx-xxxx-xxxxxxxx-xxxxxxxxx' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/#####-####-#####-####-#######' or the scope is invalid. If access was recently granted, please refresh your credentials. Correlation ID: 46eda7d1-f6f0-faf6-8d48-b7d7441a21d4
The exact same error comes out when i'm trying to refresh credentials with Azure CLI, scope is valid.
Thank you for your help.

Answer 1

Hi @Eugene Shvydko

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

If your access is restricted to certain resource groups, make sure you have the right permissions at the resource group level. Go to "Resource groups," select the group, and check your role assignments

Check that there are no Azure AD policies or restrictions blocking your account from logging in and getting the necessary permissions.

Sometimes, it takes a little time for role assignments to take effect in Azure. If you’ve just been assigned the role, wait a few moments and then try again.

For reference, please review this documentation:-

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits

https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting?tabs=bicep

https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

https://learn.microsoft.com/en-us/cli/azure/role/assignment?view=azure-cli-latest

If you have any further queries, do let us know.

---

If the answer is helpful, please and "Upvote it".

Answer 2

Hello Eugene Shvydko,

Thanks for your questio

Deny assignments override role-based access. Look for deny policies in Subscription IAM > Deny assignments.

Check your assigned role permissions. It is possible it was assigned from a mgt group rather than subscription scope. If this the case, Create a custom role with explicit Microsoft.Resources/subscriptions/resourceGroups/read permissions and assign it to your account.

To create one, see: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola